How does Sagan know that one log line is ending and a new beginning when reading from a FIFO?

[steverawls]

[k9io]

I know what this is about, but to avoid confusion:

pipes delimit the syslog fields, new lines are what determines the end of a log. Your real issues is "what if there are to many pipes, does Sagan mis-process them?", i think?